php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  Fix race condition in zend_runtime_jit(), zend_jit_hot_func()
This commit is contained in:
Arnaud Le Blanc
2025-10-07 10:53:21 +02:00
parent 1ca78dd98d 359ad80c4a
commit 294e408ca2
3 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -21,6 +21,8 @@ PHP NEWS
. Fixed segfault in function JIT due to NAN to bool warning. (Girgias)
. Fixed bug GH-19984 (Double-free of EG(errors)/persistent_script->warnings on
persist of already persisted file). (ilutov, Arnaud)
. Fixed bug GH-19889 (race condition in zend_runtime_jit(),
zend_jit_hot_func()). (Arnaud)
- SOAP:
. Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en).

2
Zend/Optimizer/zend_func_info.h
View File

@@ -39,7 +39,7 @@
#define ZEND_FUNC_JIT_ON_PROF_REQUEST (1<<14) /* used by JIT */
#define ZEND_FUNC_JIT_ON_HOT_COUNTERS (1<<15) /* used by JIT */
#define ZEND_FUNC_JIT_ON_HOT_TRACE (1<<16) /* used by JIT */
#define ZEND_FUNC_JITED (1<<17) /* used by JIT */
typedef struct _zend_func_info zend_func_info;
typedef struct _zend_call_info zend_call_info;

10
ext/opcache/jit/zend_jit.c
View File

@@ -3098,8 +3098,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_OPCODE_HANDLER_FUNC_CCONV zend_runtime_jit(Z
bool do_bailout = 0;
zend_shared_alloc_lock();
jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
if (ZEND_FUNC_INFO(op_array)) {
if (jit_extension && !(jit_extension->func_info.flags & ZEND_FUNC_JITED)) {
SHM_UNPROTECT();
zend_jit_unprotect();
@@ -3111,11 +3112,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_OPCODE_HANDLER_FUNC_CCONV zend_runtime_jit(Z
opline++;
}
}
jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
((zend_op*)opline)->handler = jit_extension->orig_handler;
/* perform real JIT for this function */
zend_real_jit_func(op_array, NULL, NULL, ZEND_JIT_ON_FIRST_EXEC);
jit_extension->func_info.flags |= ZEND_FUNC_JITED;
} zend_catch {
do_bailout = true;
} zend_end_try();
@@ -3182,7 +3184,7 @@ void ZEND_FASTCALL zend_jit_hot_func(zend_execute_data *execute_data, const zend
zend_shared_alloc_lock();
jit_extension = (zend_jit_op_array_hot_extension*)ZEND_FUNC_INFO(op_array);
if (jit_extension) {
if (jit_extension && !(jit_extension->func_info.flags & ZEND_FUNC_JITED)) {
SHM_UNPROTECT();
zend_jit_unprotect();
@@ -3195,6 +3197,8 @@ void ZEND_FASTCALL zend_jit_hot_func(zend_execute_data *execute_data, const zend
/* perform real JIT for this function */
zend_real_jit_func(op_array, NULL, opline, ZEND_JIT_ON_HOT_COUNTERS);
jit_extension->func_info.flags |= ZEND_FUNC_JITED;
} zend_catch {
do_bailout = 1;
} zend_end_try();